# `Stevedore.Sign.Sigstore`
[🔗](https://github.com/oshlabs/stevedore/blob/v0.2.0/lib/stevedore/sign/sigstore.ex#L1)

Sigstore/cosign key-pair primitives, native via `:public_key` (ECDSA P-256, no shelling out).

Provides key generation (PEM, the format `cosign` reads and writes), detached signing and
verification of a payload, and construction of the cosign **simple signing** payload that binds
an image's manifest digest. Keyless signing (Fulcio/Rekor) is a future opt-in.

Spec: [cosign SIGNATURE_SPEC](https://github.com/sigstore/cosign/blob/main/specs/SIGNATURE_SPEC.md).

# `key`

```elixir
@type key() ::
  binary()
  | tuple()
  | %{optional(:private) => binary(), optional(:public) => binary()}
```

# `keypair`

```elixir
@type keypair() :: %{private: binary(), public: binary()}
```

# `generate_key`

```elixir
@spec generate_key() :: keypair()
```

Generates an ECDSA P-256 keypair as PEM strings (`%{private: ..., public: ...}`).

# `payload`

```elixir
@spec payload(
  Stevedore.Digest.t(),
  keyword()
) :: binary()
```

Builds the cosign simple-signing payload binding `digest`. `opts[:reference]` sets the
docker-reference; `opts[:annotations]` populates the optional section.

# `private_key`

```elixir
@spec private_key(key()) :: tuple()
```

Resolves a key argument to a private-key record.

# `public_key`

```elixir
@spec public_key(key()) :: tuple()
```

Resolves a key argument to a public-key record.

# `sign`

```elixir
@spec sign(iodata(), key()) :: binary()
```

Signs `payload` with `key`'s private key, returning a base64 DER ECDSA signature.

# `verify`

```elixir
@spec verify(iodata(), binary(), key()) :: boolean()
```

Verifies a base64 DER signature over `payload` against `key`'s public key.

---

*Consult [api-reference.md](api-reference.md) for complete listing*